Chainalysis: Blockchain Cyberattacks Up 5x, AI Tools Drive 440% Surge

Blockchain-assisted cyberattacks have increased more than fivefold since last year, according to a new report from blockchain analytics firm Chainalysis. The report attributes the surge largely to North Korean and Iranian nation-state actors and Russian-speaking criminal groups.

Chainalysis also linked the widespread availability of Chinese open-source AI tools to a 440% rise in a specific technique called Blockchain Dead Drops. This method stores malicious payloads in on-chain transactions and smart contracts, allowing attackers to hide malware on the blockchain.

The report identifies two primary methods for hiding malware on-chain: transaction-based storage and contract-based storage. It also details a technique using 'phantom wallets' to encode command-and-control server IP addresses directly into wallet addresses.

These findings build on earlier cases of blockchain-based malware hiding. In 2013, a Necurs botnet variant stored its command-and-control domain information on Namecoin, a Bitcoin fork. In 2019, attackers encoded command-and-control IP addresses for banking malware into Bitcoin transactions, and the Glupteba crypto-mining botnet stored malicious information in Bitcoin's OP_RETURN field.

The report, covered by tomshardware.com, highlights how nation-state and criminal groups are increasingly leveraging blockchain technology to evade detection.